Choosing ports in Nmap: -p, --top-ports, -F, and scanning all 65535

The port options

-p accepts single ports, ranges, and comma lists, like -p 22,80,443,8000-8100. Prefix with T: or U: to mix protocols in one scan, as in -p T:443,U:53. -p- is shorthand for 1-65535. --top-ports N scans the N most common ports from nmap-services, and -F is a fast scan of the top 100.

Port 0 is excluded from -p- because it is reserved, but you can name it explicitly. Nmap randomizes port order by default; -r scans them sequentially, which is useful when you are watching a packet capture.

Which list answers which question

A daily or weekly inventory scan of many hosts is usually --top-ports 1000 or less, because it finishes quickly and catches the common services. A full -p- sweep is for the question “what is listening that nobody told us about”, such as a debug port on 31337 or a database on a non-standard port. Run it less often, or on a sample of hosts.

After a fix, rescan only the port in question. A targeted -p 3389 confirms remote desktop is closed in seconds and avoids rescanning everything for one ticket.

Lab: find a service the top 1000 misses

On a lab VM, start a listener on a high port with python3 -m http.server 47123. Run a default scan and confirm it misses the port. Then run a full TCP sweep with a minimum rate so it finishes in reasonable time on a lab, followed by -sV on only the ports it found.

This two-stage pattern, a fast full sweep for open ports and a slower version scan for just those ports, is how most practitioners keep -p- scans manageable.

Snippet

python3 -m http.server 47123 &   # on the VM
sudo nmap 192.168.56.101
sudo nmap -p- --min-rate 1000 -oG full.gnmap 192.168.56.101
ports=$(grep -oP "\d+/open" full.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sV -p "$ports" 192.168.56.101

Mind the cost

--min-rate forces Nmap to send at least that many packets per second, overriding its congestion control. That is fine on a host-only lab. On a shared or production network it can overload firewalls with state entries or trip rate limits, so agree on rates with the network owner.

Full UDP sweeps are a different order of cost, usually hours per host. Limit UDP to --top-ports or a named list.

Diagram

Port lists matched to questions

Start from the question, then choose the list.

-F (top 100)
Quick check of many hosts. Misses most custom ports.
--top-ports 1000
The default. A good weekly inventory baseline.
-p-
Every TCP port. Finds forgotten services. Run less often.
-p 3389
Single-port retest after a change ticket.

Check yourself

1. Which option scans TCP ports 1 through 65535?

2. Why did the default scan miss a listener on port 47123?

3. What is the risk of a high --min-rate on a production network?